       ;; TODO test that we can retrieve the items directly and ACLs are enforced
       )
     (testing "Direct transformer retrieval acl enforcement"
-      ;; TODO test that the transformer type queries will enforce ACLs
-      ;; TODO ingest some diff collections above so we can test it with them
-      )))
+      (testing "registered user"
+        (d/assert-metadata-results-match
+          :echo10 [coll2 coll4]
+          (search/find-metadata :collection :echo10 {:token user1-token
+                                                     :concept-id (conj (map :concept-id all-colls)
+                                                                       "C9999-PROV1")})))
+      (testing "guest access"
+        (d/assert-metadata-results-match
+          :echo10 [coll1 coll4 coll6 coll7 coll8]
+          (search/find-metadata :collection :echo10 {:token guest-token
+                                                     :concept-id (map :concept-id all-colls)})))
+      (testing "user in groups"
+        (d/assert-metadata-results-match
+          :echo10 [coll4 coll6 coll3 coll8 coll2]
+          (search/find-metadata :collection :echo10 {:token user3-token
+                                                     :concept-id (map :concept-id all-colls)}))))))
 
 
 ;; This tests that when acls change after collections have been indexed that collections will be

  (e/grant-guest (e/coll-catalog-item-id "provguid2"))
  ;; grant registered users permission to coll2 and coll4
  (e/grant-registered-users (e/coll-catalog-item-id "provguid1" ["coll2" "coll4"]))
  ;; grant specific group permission to coll3 and coll6
  (e/grant-group "group-guid1" (e/coll-catalog-item-id "provguid1" ["coll3"]))
  (e/grant-group "group-guid2" (e/coll-catalog-item-id "provguid2" ["coll6"]))


  (let [coll1 (d/ingest "PROV1" (dc/collection {:entry-title "coll1"}))

        ;; PROV2
        coll6 (d/ingest "PROV2" (dc/collection {:entry-title "coll6"}))
        coll7 (d/ingest "PROV2" (dc/collection {:entry-title "coll7"}))
        ;; A dif collection
        coll8 (d/ingest "PROV2" (dc/collection {:entry-title "coll8"
                                                :entry-id "S8"
                                                :short-name "S8"
                                                :version-id "V8"
                                                :long-name "coll8"}) :dif)

        all-colls [coll1 coll2 coll3 coll4 coll5 coll6 coll7 coll8]
        guest-token (e/login-guest)
        user1-token (e/login "user1")
        user2-token (e/login "user2" ["group-guid1"])
